CVE-2026-78054 is a cross-site scripting vulnerability in SourceCodester Class and Exam Timetabling System 1.0. The flaw exists due to insufficient input validation or sanitization of the 'course' parameter in the /BSIS1.php file, enabling remote attackers to execute arbitrary scripts in the context of the victim's browser. Exploit code has been publicly released, but there is no vendor advisory or official fix available at this time.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of users interacting with the affected system, potentially leading to session hijacking, defacement, or other client-side attacks. The vulnerability does not require privileges or user interaction beyond visiting a crafted URL, but user interaction is needed (UI:P). The overall impact is rated medium with a CVSS 4.0 score of 5.3.

No official patch or remediation has been confirmed by the vendor. Users should monitor the vendor's advisory channels for updates. In the meantime, applying web application firewall (WAF) rules to detect and block malicious input targeting the 'course' parameter may reduce risk. Avoid exposing the vulnerable endpoint publicly if possible until a fix is available.